CN108259438A - A kind of method and apparatus of the certification based on block chain technology - Google Patents

Abstract

The embodiment of the present invention discloses an authentication method based on blockchain technology, including: acquiring the authorization identity information of each initial application program using cloud services, establishing a blockchain based on the acquired identity information, and establishing a block chain The block chain includes a block that stores the identification information of the corresponding authorized identity information; obtains the authorized identity information of the new application program using the cloud service; When i pieces of identity information meet the preset authentication conditions, generate a block for storing the identification information of the authorization identity information of the new application, add the generated block to the corresponding block chain, and obtain a new block chain; obtain the block corresponding to the new application in the new block chain, and log in the new application based on the information stored in the obtained block. The embodiment of the invention also discloses an authentication device based on block chain technology.

Description

A method and device for authentication based on block chain technology

technical field

The present invention relates to the field of computer technology, in particular to an authentication method and device based on block chain technology.

Background technique

Platform as a Service (Platform-as-a-Service, PaaS) is a model that provides a server platform as a service. PaaS is a model of cloud computing. PaaS provides a running platform for the developed application (Application, App). The services provided by the platform also include identity authentication services. In the era of cloud computing, identity information is becoming more and more numerous, and identity authentication security issues are becoming more and more prominent. Therefore, in order to solve the problem of identity authentication security, an identity authentication model in PaaS environment is proposed, which enables PaaS cloud service providers to provide efficient and flexible identity authentication services for their applications. The advantage of this model is that it meets the needs of the same developer to develop multiple relatively independent but identical or similar identity authentications at a low cost; it is compatible with local identities and OpenID identities representing the trend of federated identity authentication, and has good scalability To be compatible with more categories of identity.

Open Authorization (Oauth) is an open standard that allows third-party applications to access various information stored on the service under the premise that the user can authorize, and this authorization does not need to provide the user name and password to the third-party usage.

OpenID is a decentralized identity authentication technology widely used in cloud computing. OpenID provides a way for users to pass through multiple cloud services with one identity, and also solves the problem of losing registration with cloud providers. The problem of not being able to log in due to cloud identity credentials. However, OpenID also frequently exposes many security vulnerabilities. For example, after a user logs in to a cloud service with an OpenID identity, he cannot access the resources owned by the user's cloud identity. authorized. Therefore, the following problems exist when constructing the identity authentication model of the PaaS platform:

OpenID technology security issues, for example: there is "phishing" (that is, electronic fraud), when users log in to a website that claims to support OpenID, they may send the entered user name and password to a fraudulent webpage; OpenID relies on routing to The uniform resource locator (Uniform Resource Locator, URL) identification of the correct machine on the Internet depends on the domain name resolution system for network address mapping. As we all know, the domain name resolution system itself has security risks.

Contents of the invention

In order to solve the above technical problems, the embodiment of the present invention expects to provide a blockchain technology-based authentication method and device, which ensures the security of identity authentication on the PaaS platform.

Technical scheme of the present invention is realized like this:

The embodiment of the present invention provides a method for authentication based on block chain technology, including:

Obtain the authorization identity information of each initial application program using the cloud service, and establish a block chain based on the obtained identity information, and the established block chain includes a block that stores the identification information of the corresponding authorization identity information;

Obtain authorization identity information for new applications using cloud services;

When the authorization identity information of the new application using the cloud service and the acquired i-th identity information meet the preset authentication conditions, generate an area for storing the identification information of the authorization identity information of the new application Block, after adding the generated block to the block chain corresponding to the i-th identity information obtained, a new block chain is obtained, i takes an integer from 1 to n, and n represents the number of identity information obtained;

When it is determined that the cloud service needs to be used to log in the new application, obtain the block corresponding to the new application in the new block chain, and log in the new application based on the information stored in the obtained block. s application.

In the above scheme, after obtaining the authorization identity information of the new application program using the cloud service, the method further includes: calculating the authorization identity information of the new application program using the cloud service according to a preset similarity calculation method The similarity with each identity information obtained;

The preset authentication condition includes: the similarity between the authorized identity information of the new application program using the cloud service and the acquired i-th identity information is greater than a similarity threshold.

In the above solution, the preset authentication condition further includes: the authorization identity information of the new application program using the cloud service passes the user verification.

In the above solution, the authorization identity information of the new application program includes at least one of the following information: user name, email address, contact information, age, and occupation.

In the above solution, the identification information of the authorization identity information of the new application program is: part of the information in the authorization identity information of the new application program.

In the above solution, the method further includes: setting access permission information for each application program using the cloud service, the access permission information is used to indicate whether to allow the use of the necessary authorized resources of the corresponding application program, and/or to indicate whether to It is allowed to use non-essentially authorized resources of the corresponding application program, and the required authorized resources of the corresponding application program are resources of the cloud service that must be used to ensure the operation of the corresponding application program.

The embodiment of the present invention also provides an authentication device based on blockchain technology, the device includes: an establishment module, an acquisition module, an authentication module and a login module; wherein,

A building module is used to obtain the authorization identity information of each initial application program using the cloud service, and establish a block chain based on the obtained identity information. block;

An obtaining module, used to obtain authorization identity information of a new application program using cloud services;

An authentication module, configured to generate an authorization identity for storing the new application when the authorization identity information of the new application using the cloud service and the acquired i-th identity information meet a preset authentication condition After adding the generated block to the block chain corresponding to the i-th identity information obtained, a new block chain is obtained. i takes an integer from 1 to n, and n represents the obtained the number of identity information;

A login module, configured to obtain a block corresponding to the new application in the new blockchain when it is determined that the new application needs to be logged in using cloud services, based on the Information to log in to the new application.

In the above solution, the authentication module is further configured to calculate the similarity between the authorized identity information of the new application using the cloud service and each of the acquired identity information according to a preset similarity calculation method;

The preset authentication condition includes: the similarity between the authorized identity information of the new application program using the cloud service and the acquired i-th identity information is greater than a similarity threshold.

In the above solution, the preset authentication condition further includes: the authorization identity information of the new application program using the cloud service passes the user verification.

In the above solution, the authorization identity information of the new application program includes at least one of the following information: user name, email address, contact information, age, and occupation.

In the above solution, the identification information of the authorization identity information of the new application program is: part of the information in the authorization identity information of the new application program.

In the above solution, the device further includes: an authorization module; the authorization module is configured to set access rights information for each application program using the cloud service, and the access rights information is used to indicate whether the corresponding application program is allowed to use Authorized resources, and/or used to indicate whether to allow the use of non-essential authorized resources of the corresponding application program, and the required authorized resources of the corresponding application program are resources of the cloud service that must be used to ensure the operation of the corresponding application program.

In the embodiment of the present invention, the authorization identity information of each initial application program using the cloud service is obtained, and a block chain is established based on the obtained identity information, and the established block chain includes an identification information storing corresponding authorization identity information block; obtain the authorization identity information of the new application program using the cloud service; when the authorization identity information of the new application program using the cloud service and the acquired i-th identity information meet the preset authentication conditions, generate A block used to store the identification information of the authorization identity information of the new application program, after adding the generated block to the block chain corresponding to the obtained i-th identity information, a new block chain is obtained, i Take an integer from 1 to n, where n represents the number of identity information obtained; when it is determined that the new application needs to be logged in using cloud services, obtain the information corresponding to the new application in the new block chain and register the new application program based on the information stored in the acquired block. In this way, the security of identity authentication on the PaaS platform is guaranteed.

Description of drawings

Fig. 1 is a schematic diagram of the basic structure of the block chain in the embodiment of the present invention;

Fig. 2 is the flowchart of the first embodiment of the authentication method based on block chain technology of the present invention;

Fig. 3 is a schematic diagram of an authorization process based on blockchain technology in an embodiment of the present invention;

4 is a schematic diagram of an authentication process based on blockchain technology in an embodiment of the present invention;

Fig. 5 is the flowchart of the second embodiment of the authentication method based on block chain technology of the present invention;

Fig. 6 is the flowchart of the third embodiment of the authentication method based on block chain technology of the present invention;

FIG. 7 is a schematic diagram of the composition and structure of an authentication device based on blockchain technology according to an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention.

blockchain technology

Blockchain (Block chain), also known as distributed ledger, is an Internet database technology that maintains a reliable database technical solution through decentralization and trustless collectives. The characteristics of the decentralized distributed structure of the blockchain allow each node to verify the correctness of the data recorded by other nodes while participating in the record. Each node is peer-to-peer, and data is public between nodes.

Blockchain is the core technology of the Bitcoin system, which was first proposed in the Bitcoin paper published by Satoshi Nakamoto in 2008. The purpose of adopting the blockchain is to realize the decentralized payment system required by the Bitcoin system. Such a system needs to solve the trust problem between the two parties in the transaction, the double payment problem, and the Byzantine general problem. In order to achieve such a goal, Satoshi Nakamoto introduced the transaction model, proof of work, network system, reward mechanism, verification model and other aspects in the paper.

Satoshi Nakamoto's paper focuses on the introduction of Bitcoin's description of the blockchain to realize the Bitcoin system, so the description of the blockchain technology system itself is not very clear. Later researchers conducted more in-depth research on the blockchain technology system. Yuan Yong and Wang Feiyue introduced the technical system of blockchain in detail in a blockchain overview article. The blockchain contains many contents from the underlying data structure to the consensus mechanism to the top-level application protocol. The functions of each part are different, so a hierarchical structure is used to introduce the contents of each part.

Figure 1 is a schematic diagram of the basic structure of the blockchain in the embodiment of the present invention. As shown in Figure 1, the basic structure of the blockchain is divided into 6 layers, including: data layer, network layer, consensus layer, incentive layer, contract layer, application Floor. Each layer completes a core function respectively, and each layer cooperates with each other to realize a decentralized trust mechanism.

Among them, the application layer includes: programmable goods comparison, programmable finance and programmable society; the contract layer includes: script code, algorithm mechanism and contract mechanism; the incentive layer includes: issuance mechanism and distribution mechanism; the consensus layer includes: workload proof ( Proof of Work (PoW), Proof of Stake (PoS)), Delegate Proof of Stake (DPoS), etc.

The data layer and the network layer are used to realize the main functions of the blockchain. The data layer mainly describes the physical form of the blockchain technology, including: data blocks, chain structures, timestamps, hash functions, Merkle trees, encryption algorithms, etc. The blockchain contains two main features: data block and chain structure. The physical realization of blockchain technology is a chain composed of multiple blocks with the same specifications connected sequentially through a chain structure. The first block in the chain becomes the genesis block, which is established by the system designer. After the genesis block is established, according to the establishment rules, the nodes in the blockchain network generate new blocks, and after verification, the new block Blocks are linked on the main chain. As the system runs longer, the main chain will continue to extend. For example, the main chain of the Bitcoin blockchain has 415,291 blocks as of June 8, 2016. These blocks contain information that needs to be recorded for specific applications, such as storing transaction information in the Bitcoin blockchain. In order to ensure the security of each block, many technologies are used in existing technologies, such as: time stamp technology to ensure that each block is linked in time sequence, hash function to ensure that transaction information is not tampered with, and merkle tree to record specific transactions Information, asymmetric encryption to achieve identity authentication, etc. It should be noted that the above blockchain structure is only a basic format, and the blockchain can be adaptively changed for different application environments.

Each block in the blockchain can include: a block header and a block body. Blocks are generated one by one in chronological order, and each block records all transaction information that occurred during its creation, and all blocks are aggregated to form a set that records all transaction information.

The main purpose of the network layer is to realize information exchange between nodes in the blockchain network, including: P2P network, propagation mechanism and verification mechanism, etc. The blockchain network is essentially a peer-to-peer network (Peer-to-Peer Networking, P2P), each node not only receives information, but also generates information. Nodes maintain communication by maintaining a common blockchain. In the blockchain network, every node is fair and can create a new block. After the node creates a new block, it sends it to other nodes in the form of broadcast, and other nodes will verify the block information. Only after at least 51% of users pass the verification of the new block, the new block will be approved, and the nodes in the network will link this block to the main chain list. The specific block verification method depends on the verification mechanism established by each node in the actual application.

The embodiment of the present invention realizes the identity authentication on the PaaS platform based on the bottom layer (ie data layer and network layer) technology of the above-mentioned block chain.

first embodiment

Fig. 2 is the flowchart of the first embodiment of the method of authentication based on block chain technology of the present invention, as shown in Fig. 2, this method comprises:

Step 200: Obtain the authorization identity information of each initial application program using the cloud service, and establish a block chain based on the obtained identity information. The established block chain includes a block storing the identification information of the corresponding authorization identity information .

In this step, the authorization identity information of each initial application program includes at least one of the following information: user name, email address, contact information, age, occupation, and so on.

In practical applications, users usually need to use personally identifiable information to register an account when using an application. When registering an account, they usually need to enter personal identifiable information such as user name, email address, contact information, age or occupation, and the same user is in the There is great similarity in identity information in multiple applications. Therefore, the identity information of all applications registered by the user can be found through the principle of identity information similarity, and the identity information registered by the same user in different applications can be combined to establish a user identity information block chain, in which each block saves The identification information corresponding to the authorization information required when the user logs in to the application. Here, the identification information is used to log in the corresponding application program after the authorization information is authenticated.

Step 201: Obtain authorization identity information of a new application program using cloud services.

Taking the implementation of the Oauth2 protocol on the PaaS platform as an example, when the user first uses Oauth2 to log in to a new application in the cloud service, identity discovery and federation operations are required. This operation occurs after the user authorizes the identity information of the new application. , the Oauth2 service performs identity information discovery and federation operations by sending authorized identity information to the cloud service.

Step 202: When the authorization identity information of the new application using the cloud service and the acquired i-th identity information meet the preset authentication conditions, generate an identifier for storing the authorization identity information of the new application After adding the generated block to the block chain corresponding to the i-th identity information obtained, a new block chain is obtained, where i takes an integer from 1 to n, and n represents the number of the obtained identity information number.

After obtaining the authorized identity information of the new application program using the cloud service, it also includes: calculating the authorized identity information of the new application program using the cloud service and each acquired identity according to the preset similarity calculation method information similarity.

The preset authentication condition may include: the similarity between the authorized identity information of the new application program using the cloud service and the acquired i-th identity information is greater than a similarity threshold.

In actual implementation, the preset authentication condition may also include: the authorization identity information of the new application program using the cloud service passes the user verification.

Exemplarily, the preset similarity calculation method may be to obtain the similarity by counting the number of identical information between the authorized identity information and each identity information in the cloud service, for example, setting the number of identical information to represent the similarity of the authorized identity information When initializing, the number of identical information is set to 0. When any information such as user name, password, mobile phone number, email address or nickname is the same, the number of identical information is increased by 1. After calculating the similarity between the authorized identity information and all the acquired identity information, it is judged whether the value of the same number of information between the authorized identity information and the i-th identity information obtained in the cloud service is greater than the similarity threshold, and if so, generate A block that stores the identification information of the authorization identity information of the new application program, and the generated block is added to the block chain corresponding to the acquired i-th identity information.

The identification information of the authorization identity information of the new application program is: part of the information in the authorization identity information of the new application program.

Exemplarily, when the authorized identity information includes: user name, email address, and contact information, the user name can be used as the identification information of the application program identity information, and the user name can be stored in the corresponding block of the application program.

Step 203: When it is determined that the cloud service needs to be used to log in the new application, obtain the block corresponding to the new application in the new blockchain, and log in based on the information stored in the obtained block The new application.

In this step, after the identity information association is completed, that is, after the new block chain is created, the user can directly use the identification information stored in the block to access the resources of the corresponding application program on the cloud service.

The embodiment of the present invention may also include: setting access permission information for each application program using the cloud service, the access permission information is used to indicate whether to allow the use of the necessary authorized resources of the corresponding application program, and/or to indicate whether to allow the use of The non-essential authorization resources corresponding to the application program are the resources of the cloud service that must be used to ensure the operation of the corresponding application program. In this way, fine-grained authorization is realized to improve the adaptability of the PaaS platform.

The embodiment of the present invention realizes the union of all identity information of the same user in the cloud service, realizes multiple identity authentication, and ensures the security and reliability of identity authentication. However, in the prior art, the Oauth2 protocol does not support multiple identity information in the cloud service. A combination of identity information.

Figure 3 is a schematic diagram of the authorization process based on blockchain technology in the embodiment of the present invention. As shown in Figure 3, after the user obtains the identity information registered by the third-party application program, the PaaS platform first performs the authorization process on the identity information authorized by the third-party application program. Digital signature, specifically, the PaaS platform digitally signs the authorized identity information, and then sends the digital signature to the Secure Hash Algorithm (SHA) verifier for encryption to generate a verification code. Verify the code to create the corresponding block, and save the verification code in the new block. The PaaS platform will authenticate and authorize the created new block, verify the block information, and add the block after the block verification is passed. Go to the corresponding blockchain to complete the authorization and authentication of user identity information.

Figure 4 is a schematic diagram of the authentication process based on blockchain technology in the embodiment of the present invention. As shown in Figure 4, the user sends an authentication request through a third-party application program, and after the authentication request is propagated to the cloud service through the P2P network, the PaaS The platform verifies the authentication request through the verification code information stored in the corresponding blockchain, and spreads the verification result through the P2P network. When the authentication request information matches the verification code information stored in the blockchain, the third party The application directly accesses the data storage space corresponding to the cloud service and obtains authorized resources.

In the embodiment of the present invention, the authorization identity information of each initial application program using the cloud service is obtained, and a block chain is established based on the obtained identity information, and the established block chain includes an identification information storing corresponding authorization identity information block; obtain the authorization identity information of the new application program using the cloud service; when the authorization identity information of the new application program using the cloud service and the acquired i-th identity information meet the preset authentication conditions, generate A block used to store the identification information of the authorization identity information of the new application program, after adding the generated block to the block chain corresponding to the obtained i-th identity information, a new block chain is obtained, i Take an integer from 1 to n, where n represents the number of identity information obtained; when it is determined that the new application needs to be logged in using cloud services, obtain the information corresponding to the new application in the new block chain and register the new application program based on the information stored in the acquired block. In this way, the security of identity authentication on the PaaS platform is guaranteed, and fine-grained authorization is realized to improve the adaptability of the PaaS platform.

second embodiment

In order to better reflect the purpose of the present invention, further illustrations are made on the basis of the first embodiment of the present invention.

Fig. 5 is the flowchart of the second embodiment of the authentication method based on block chain technology of the present invention, as shown in Fig. 5, the method includes:

Step 500: Use the identity information of all applications authorized by the user to establish a corresponding blockchain.

It can be understood that when the same user registers multiple different applications with similar identity information, the identity information registered by each application can be used to establish a blockchain of application authorization information corresponding to the user.

Step 501: Obtain authorization identity information of a new application program.

When the user registers a new application with similar identity information again, obtain the new identity information and perform identity discovery and federation operations.

Step 502: Calculate the similarity between the new authorized identity information and the already authorized identity information in the cloud service.

Optionally, first obtain all authorized identity information similar to the new authorized identity information in the cloud service, specifically, the obtained authorized identity information contains at least one piece of information that is the same as the new authorized identity information, for example , user name, email address or phone number, etc.; secondly, calculate the similarity between the new authorized identity information and the obtained i-th authorized identity information, the higher the similarity, the possibility that the new authorized identity information and the authorized identity information come from the same user The greater the reliability, if it is determined to be the same user, different authorized identity information can be combined to establish the user's identity information blockchain.

Step 503: Determine whether the similarity is greater than the similarity threshold, if yes, execute step 504; if not, execute step 507.

Step 504: Generate a block for storing the identification information of the authorization identity information of the new application program.

When the similarity is greater than the similarity threshold, it means that the new authorized identity information is associated with the already authorized identity information in the cloud service, and the information may come from the same user's authorization information for different third-party applications. At this time, part of the new authorization information can be stored in the corresponding block as identification information. Here, in order to ensure the user's personal privacy information, part of the information can be user name or other non-private information; identification information can also be authorization identity information The ciphertext information generated by encryption algorithm encryption, commonly used encryption algorithms are: Digital Encryption Standard (Data Encryption Standard, DES), International Data Encryption Algorithm (International Data Encryption Algorithm, IDEA), public key encryption algorithm (Ron Rivest, Adi Shamir, Leonard Adleman, RSA). The identification information may also be summary information generated by hashing the authorized identity information.

Step 505: Determine whether the block has passed the verification of the PaaS platform, if yes, execute step 506; if not, execute step 507.

In this step, the PaaS platform can use the newly generated block to generate a challenge response and send it to the user to confirm whether the matched identity is the user’s identity information in the cloud service, and if so, determine that the block has passed the authentication , if not, the block has not passed the authentication, indicating that the authentication of the new authorized identity information fails, and at this time, the identity authentication service is performed according to the existing Oauth2 protocol.

Step 506: After the generated block is added to the block chain corresponding to the acquired i-th identity information, the authentication and authorization of the PaaS platform is completed.

Specifically, after the block authentication is passed, the block is propagated on the PaaS platform through the P2P network, so as to update the identity information block chain corresponding to the user.

Step 507: Perform identity authentication service according to the existing Oauth2 protocol.

In actual implementation, if the user identity information is successfully combined, when the user uses Oauth2 to access the cloud service, the Oauth2 service can directly use the third-party application program on the cloud service with the identification information stored in the block without user authorization. At this time, the user The data space of the accessed cloud service is actually the data space corresponding to the cloud identity in the cloud service. If the identity association fails, that is, no similar identity information is found or the user confirmation fails, the identity authentication service is performed according to the existing Oauth2 protocol.

In the Oauth2 protocol, since the cloud service authenticates the user by verifying the user's Oauth2 identity information sent by the Oauth2 service, all operations and data after the user logs in are associated with this Oauth2 identity, and malicious attackers can use this Oauth2 identity Retrieve the activity information of the OpenID identity in different cloud services to spy on user privacy, and this attack is especially common in social networks.

However, in the embodiment of the present invention, due to the introduction of identity information discovery and association, the automatic association of new authorized identity information is realized without the need for users to input all authorized identity information, which reduces the burden on users and avoids The problem of resource inaccessibility caused by identity information. At the same time, in the case of successful combination of identity information, since the identity information transmitted by the Oauth2 service to the third-party cloud service only includes the identification information of the user's login application identity information, all operations and data after the user login only display the identification information Therefore, it can prevent privacy spying to a certain extent and protect user privacy.

third embodiment

In order to better reflect the purpose of the present invention, further illustrations are made on the basis of the first embodiment of the present invention.

Fig. 6 is a flow chart of the third embodiment of the authentication method based on blockchain technology of the present invention. As shown in Fig. 6, after the identity information authorized by the user is authenticated, the user can The saved authorization information directly accesses the corresponding resources in the cloud service, and fine-grained authorization is performed on the accessed resources. The specific execution process can be as follows:

Step 600: Set access rights to the resources of each third-party application program in the cloud service.

Specifically, restrict the attributes of the scope field used to specify the requested resources in the Oauth2 protocol. When a third-party application sends an access request, it first marks the resources requested in the scope with the labels "must authorize" and "optionally authorize". . Among them, "required authorization" means that the access rights of marked resources are unlimited, and "optional authorization" means that users of marked resources can freely set access rights.

However, in the prior art, when a third-party application program requests a resource of a cloud service, it needs to obtain authorization from the user. The OAuth2 protocol sends the request by specifying all the resources to be accessed once in the scope field. However, in most OAuth implementations, the user can only accept or reject the one-time resource authorization request, but cannot freely choose to authorize or deauthorize a specific resource. Especially in the process of identity information authorization, when third-party cloud services request sensitive information such as phone numbers and addresses that users do not want to authorize, users cannot refuse because they want to use the functions of third-party applications, which seriously reduces the resource utilization of users. safety. Therefore, in the embodiment of the present invention, by performing fine-grained authorization on accessed resources, the security of user resources is ensured, and the adaptability of the PaaS platform is improved.

Step 601: The third-party application program directly accesses the data space of the third application program in the cloud service through the authorization information stored in the blockchain.

Step 602: The user performs authorization settings for the resources requested to be accessed by the third-party application program.

Exemplarily, the third application A sends a resource access request to the cloud service, and the cloud service logs in the third-party application according to the authorization information stored in the corresponding block by the third-party application A, and then sends the requested resource information to the user , the user authorizes the resource selection. The user can only choose to accept the authorization for the "required authorization" resources, and can flexibly set the authorization for the "optional authorization" resources, such as the number of authorization times, authorization time, authorized objects, etc., and can also refuse authorization. For "required authorization" resources, cloud services can directly authorize without reminding users, and for "optional authorization" resources, users can be reminded to make authorization choices. By fine-grained authorization of resources, that is, resources are divided into "required authorization" and "optional authorization", on the one hand, it ensures that the functions of third-party applications are not affected, and on the other hand, it also protects users' sensitive resources.

Step 603: The third-party application program accesses the resources authorized by the user on the cloud service according to the authorization settings of the user.

Specifically, resources that are "must be authorized" can be obtained unconditionally, and resources that are "optionally authorized" can only be obtained when the authorization conditions are satisfied, otherwise they cannot be obtained.

third embodiment

For the method of the embodiment of the present invention, the embodiment of the present invention also provides an authentication device based on block chain technology. FIG. 7 is a schematic diagram of the composition and structure of a device for authentication based on blockchain technology in an embodiment of the present invention. As shown in FIG. 7 , the device includes: an establishment module 700, an acquisition module 701, an authentication module 702, and a login module 703; wherein,

The establishment module 700 is used to obtain the authorization identity information of each initial application program using the cloud service, and establish a block chain based on the obtained identity information, and the established block chain includes an identification information storing corresponding authorization identity information block;

An obtaining module 701, configured to obtain authorization identity information of a new application program using cloud services;

An authentication module 702, configured to generate an authorization for storing the new application when the authorization identity information of the new application using the cloud service and the acquired i-th identity information meet a preset authentication condition The identification information block of the identity information, after adding the generated block to the block chain corresponding to the i-th identity information obtained, a new block chain is obtained, i takes an integer from 1 to n, and n represents the obtained The number of identity information;

The login module 703 is configured to obtain a block corresponding to the new application in the new blockchain when it is determined that the new application needs to be logged in using cloud services, based on the blocks stored in the obtained block information to log into the new application.

Preferably, the authentication module 702 is further configured to calculate the similarity between the authorization identity information of the new application using the cloud service and each of the acquired identity information according to a preset similarity calculation method;

The preset authentication condition may include: the similarity between the authorized identity information of the new application program using the cloud service and the acquired i-th identity information is greater than a similarity threshold.

The preset authentication condition may also include: the authorization identity information of the new application program using the cloud service passes the user authentication.

Optionally, the authorization identity information of the new application program includes at least one of the following information: user name, email address, contact information, age, and occupation.

Preferably, the identification information of the authorization identity information of the new application program is: part of the information in the authorization identity information of the new application program.

Preferably, the device may further include: an authorization module; the authorization module is configured to set access rights information for each application program using the cloud service, and the access rights information is used to indicate whether to allow the use of the necessary authorized resources of the corresponding application program , and/or used to indicate whether to allow use of non-essentially authorized resources of the corresponding application program, where the required authorized resources of the corresponding application program are resources of the cloud service that must be used to ensure the operation of the corresponding application program.

In practical applications, the establishment module 700, the acquisition module 701, the authentication module 702 and the login module 703 can all be composed of a central processing unit (Central Processing Unit, CPU), a microprocessor (MicroProcessor Unit, MPU), digital signal Processor (Digital Signal Processor, DSP), or Field Programmable Gate Array (Field Programmable Gate Array, FPGA) and other implementations.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods, systems, or computer program products. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (12)

1. A method for authentication based on blockchain technology, characterized in that the method comprises: Obtain the authorization identity information of each initial application program using the cloud service, and establish a block chain based on the obtained identity information, and the established block chain includes a block that stores the identification information of the corresponding authorization identity information; Obtain authorization identity information for new applications using cloud services; When the authorization identity information of the new application using the cloud service and the acquired i-th identity information meet the preset authentication conditions, generate an area for storing the identification information of the authorization identity information of the new application Block, after adding the generated block to the block chain corresponding to the i-th identity information obtained, a new block chain is obtained, i takes an integer from 1 to n, and n represents the number of identity information obtained; When it is determined that the cloud service needs to be used to log in the new application, obtain the block corresponding to the new application in the new block chain, and log in the new application based on the information stored in the obtained block. s application. 2. The method according to claim 1, characterized in that, after obtaining the authorization identity information of the new application program using the cloud service, the method further comprises: calculating the usage The similarity between the authorization identity information of the new application program of the cloud service and each identity information obtained; The preset authentication condition includes: the similarity between the authorized identity information of the new application program using the cloud service and the acquired i-th identity information is greater than a similarity threshold. 3. The method according to claim 2, wherein the preset authentication condition further comprises: the authorization identity information of the new application program using the cloud service passes user verification. 4. The method according to claim 1, wherein the authorization identity information of the new application program includes at least one of the following information: user name, email address, contact information, age, occupation. 5. The method according to claim 1, wherein the identification information of the authorization identity information of the new application program is: part of the information in the authorization identity information of the new application program. 6. The method according to claim 1, further comprising: setting access permission information for each application program using cloud services, the access permission information being used to indicate whether to allow the use of the corresponding application program Mandatory authorized resources, and/or used to indicate whether to allow the use of non-essentially authorized resources of the corresponding application program, said corresponding application program's required authorized resources are resources of the cloud service that must be used to ensure that the corresponding application program runs. 7. A device for authentication based on block chain technology, characterized in that the device includes: an establishment module, an acquisition module, an authentication module and a login module; wherein, A building module is used to obtain the authorization identity information of each initial application program using the cloud service, and establish a block chain based on the obtained identity information. block; An obtaining module, used to obtain authorization identity information of a new application program using cloud services; An authentication module, configured to generate an authorization identity for storing the new application when the authorization identity information of the new application using the cloud service and the acquired i-th identity information meet a preset authentication condition After adding the generated block to the block chain corresponding to the i-th identity information obtained, a new block chain is obtained. i takes an integer from 1 to n, and n represents the obtained the number of identity information; A login module, configured to obtain a block corresponding to the new application in the new blockchain when it is determined that the new application needs to be logged in using cloud services, based on the Information to log in to the new application. 8. The device according to claim 7, wherein the authentication module is further configured to calculate the authorization identity information of the new application using the cloud service and the acquired The similarity of each identity information of the The preset authentication condition includes: the similarity between the authorized identity information of the new application program using the cloud service and the acquired i-th identity information is greater than a similarity threshold. 9. The device according to claim 8, wherein the preset authentication condition further comprises: the authorization identity information of the new application program using the cloud service passes user verification. 10. The device according to claim 7, wherein the authorization identity information of the new application program includes at least one of the following information: user name, email address, contact information, age, occupation. 11. The device according to claim 7, wherein the identification information of the authorization identity information of the new application program is: part of the information in the authorization identity information of the new application program. 12. The device according to claim 7, further comprising: an authorization module; the authorization module is configured to set access rights information for each application program using cloud services, the access rights information It is used to indicate whether to allow the use of the necessary authorization resources of the corresponding application program, and/or to indicate whether to allow the use of the non-essential authorization resources of the corresponding application program. The resources of the cloud service used.